DDoS attack paralyzes Norwegian digital services: ID-porten still unstable

DDoS attack paralyzes Norwegian digital services

A massive DDoS attack hit the Norwegian Agency for Digitalization (Digdir) from Sunday night to Monday, paralyzing critical services used by the entire public sector for hours. The assault, which began at 3:38 AM on August 21 local time, affected key systems such as ID-porten (the identity gateway), Maskinporten (the machine-to-machine authentication hub), and the digital signature service eSignering.

Quick Response

The Operational Impact

All major agency services experienced outages: ID-porten, the booking registry, the messaging service eFormidling, the ELMA address registry, and the Altinn portal. "Services were completely inaccessible for short periods and suffered significant slowdowns, especially in login operations," Digdir stated. The agency worked with subcontractor Vivicta to implement defensive measures, but at the time of writing, only ID-porten remained partially inoperable.

Technical Analysis of the Attack

Denis Calderone, COO of Suzu Labs, explained that Norway's centralized architecture—which channels all public services through a single authentication gateway—represents both an advantage and a vulnerability. "When choosing this architecture, it is essential to have all possible DDoS defenses perfectly calibrated for that critical point," he said. The attack appears to be aimed solely at compromising service availability, without attempting to penetrate the systems.

The Geopolitical Context

Kevin Surace, CEO of Token, noted how the attack exhibits typical characteristics of a Russian disruption campaign. "Cybercriminals do not need to access government systems to destabilize a country: just preventing user access is enough," he observed. This aggression is part of a series of recent attacks against Norway, including a cyber-espionage incident that affected 12 ministries last July, exploiting a zero-day vulnerability in Ivanti.

The Vulnerability of Centralized Services

The Norwegian model, which concentrates all digital public services through a single authentication gateway, represents an attractive target for attackers. Frode Danielsen, director of Digdir, underscored the gravity of the situation: "Our centralized digital services are used by the entire Norwegian public sector, and when these are unavailable, the consequences are serious."

The Technical Response

Digdir and Vivicta collaborated to implement defensive measures, but experts warn that this attack may be just the beginning. "When making a centralized architectural choice, it is crucial to have all possible DDoS defenses perfectly calibrated for that critical point," Denis Calderone stated. Norway, with a population of fewer than six million, has become a frequent target for various types of cyberattacks.

Implications for the Private Sector

Norwegian companies have also been targeted by criminal groups. In 2023, Tomra, a recycling giant, and Norsk Hydro, a major aluminum producer, were hit by ransomware attacks. These episodes highlight how Norway is facing a growing cyber threat on multiple fronts.

The Current Situation

According to the latest status update, most services have resumed operation, although some continue to experience operational disruptions. ID-porten remains partially inaccessible, which is a significant problem for users and organizations that rely on this identity gateway to access digital public services.

Future Challenges

This attack highlights the need for Norway to further strengthen its defenses against DDoS attacks. As the digitalization of public services increases, the vulnerability of a single access point becomes increasingly critical. Experts suggest that the Norwegian government should consider additional measures to protect its key systems from future attacks.